[IP] more on Fatal Flaw Weakens RFID Passports
Begin forwarded message:
From: Ross Stapleton-Gray <ross@xxxxxxxxxxxxxxxxxx>
Date: November 3, 2005 4:14:49 PM EST
To: dave@xxxxxxxxxx
Subject: Re: [IP] Fatal Flaw Weakens RFID Passports
At 12:47 PM 11/3/2005, Bruce Schneier wrote:
The State Department has done a great job addressing specific
security and privacy concerns, but its lack of technical skills is
hurting it. The collision-avoidance ID is just one example of
where, apparently, the State Department didn't have enough of the
expertise it needed to do this right.
Of course it can fix the problem, but the real issue is how many
other problems like this are lurking in the details of its design?
We don't know, and I doubt the State Department knows either. The
only way to vet its design, and to convince us that RFID is
necessary, would be to open it up to public scrutiny.
I think there's a lot of whistling in the dark as regards what
happens when both RFID and tags become much more pervasive; it's not
hard to imagine that there will be tipping points when the RF
environment becomes sufficiently "chatty" to support making
inferences on what's observable by third parties.
We've just published a white paper, "RFID: Airport Greeters and Amber
Alerts," on several scenarios for RFID-based monitoring, on the theme
of 3rd-party collection: http://www.stapleton-gray.com/papers/
scenarios.pdf
I'd suggest that some of the things we're seeing with cell phones,
e.g., the deployment of traffic intuiting systems in Missouri
previously documented on the IP list (gauging auto traffic by
monitoring cell handoffs), or the work done at the MIT Media Lab in
their Reality Mining project (http://reality.media.mit.edu/), will be
all the more possible with RFID, due to the "rampant promiscuity" of
the technology.
Ross
----
Ross Stapleton-Gray, Ph.D.
Stapleton-Gray & Associates, Inc.
http://www.stapleton-gray.com
http://www.sortingdoor.com
-------------------------------------
You are subscribed as roessler@xxxxxxxxxxxxxxxxxx
To manage your subscription, go to
http://v2.listbox.com/member/?listname=ip
Archives at: http://www.interesting-people.org/archives/interesting-people/